Is Your Small Business Ready for AI? A 5-Question AI Readiness Checklist
Many small businesses now use some form of AI, but using it and getting value from it are two different things. This AI readiness checklist gives you five questions to answer before you buy another AI tool, a simple way to score yourself, and the two projects that tend to pay off fastest.
Quick answer: is your small business ready for AI?
Your business is ready for AI when you can say yes to five things:
- Clean data: you can find the records and files AI would work with, in one place, in under two minutes.
- A clear use case: you can name a specific, repetitive task you want AI to take on.
- Team habits: your team has agreed which AI tools to use and what data never goes into them.
- Connected tools: the AI tool works inside the software your team already uses.
- Data privacy: you know where your data goes, and your team uses business accounts instead of personal ones.
Score each one green (2 points), yellow (1), or red (0) with the scorecard below. A total of 8 to 10 means you are ready to pilot, as long as neither clean data nor data privacy scores red.
What does AI readiness mean for a small business?
AI readiness is how prepared a small business is to get measurable value from AI tools without creating new security or privacy risks, judged on five things: clean data, a clear use case, team habits, connected tools, and data privacy.
It does not mean you need an IT department, a data science budget, or enterprise software. It means you have answered five practical questions before you commit to a tool or a vendor.
Why does readiness matter if so many businesses already use AI?
In Intuit QuickBooks' 2026 AI Impact Report, 77% of U.S. small and midsize businesses (up to 100 employees) said they used AI regularly as of January 2026, up from 48% in July 2024. That count includes free tools and AI features built into software they already use. Surveys that define use differently find less: in the Federal Reserve Banks' 2025 Small Business Credit Survey, 46% of small employer firms said the business or its employees currently use AI.
Far fewer have built it into how they work. In a Goldman Sachs survey of more than 2,400 graduates of its 10,000 Small Businesses program, published in October 2026, 86% said they use AI, but only 15% had fully integrated it into their operations, and more than three-quarters said they could use more training and resources. Earlier, an SBA Office of Advocacy analysis of Census Bureau survey data from late 2023 and early 2024 found that about half of small firms using AI had made no investments to support it, such as employee training, compared with 40% of large firms.
The result is a lot of businesses using AI, free or paid, without it moving the business forward. This guide is for the owner or operations lead who wants to get it right.
The AI readiness checklist: five questions to answer
1. Clean data: is your data clean enough to be useful?
AI tools are only as good as the information you give them. A CRM full of duplicate records, a file server with no naming conventions, or customer details scattered across spreadsheets, email, and sticky notes will produce poor results no matter how capable the tool is.
Ask yourself:
- Can you find a specific customer record or document in under two minutes?
- Are your files stored in one place with a consistent structure, rather than spread across five different apps?
- Do you have at least six months of reasonably complete history in the area where you want AI to help?
How to score it:
- Green: yes to all three. You are ready to move.
- Yellow: yes to two. Fix the third before you buy anything.
- Red: yes to one or none. Start with a data cleanup project, not an AI project.
2. A clear use case: can you name a specific, repetitive task for AI to take on?
The most common mistake is adopting AI in the abstract. "We want to use AI to be more efficient" is not a use case. "We want to stop writing follow-up emails by hand after every sales call" is.
Audit one week of your team's work and look for tasks where a person does not really need to be involved. Common first candidates:
- Drafting first-pass replies to routine emails
- Summarizing long documents, meeting notes, or support tickets
- Pulling together weekly or monthly reports from data you already have
- Answering frequently asked customer questions
Pick one, get it working from start to finish, and measure the time it saves before you add the next. A narrow first project is easier to measure, easier to train people on, and easier to undo if it does not work.
How to score it:
- Green: you can name at least one specific task and the steps it involves.
- Yellow: you have a general idea but have not mapped the steps.
- Red: you are not sure where the time goes. Do a one-week time audit first.
3. Team habits: where is your team with AI today?
Your team is probably using AI already, with or without rules. In Goldman Sachs' October 2026 report, The AI Economy Is a Small Business Economy, 74% of the business owners using AI had no formal policy on how their employees use it. In an April 2026 WatchGuard survey of 684 employees at organizations with 50 to 500 staff, 64% admitted using AI tools their employer had not approved. This is often called shadow AI.
You do not need a formal training program, but you do need honest answers to these questions:
- Is anyone on your team using AI tools on personal accounts or devices for work?
- If so, do you know which tools, and what business data goes into them?
- Have you had one conversation as a team about how AI should and should not be used in your business?
How to score it:
- Green: you have had the conversation and have at least informal rules in place.
- Yellow: some people use AI, but it has never been discussed as a team.
- Red: you genuinely do not know who is using what.
4. Connected tools: does the AI tool work inside the software you already use?
A standalone AI tool that does not connect to your CRM, accounting software, or project management platform will always feel like extra work. The tools that stick are the ones that work inside the systems your team already opens every day.
Before you evaluate any AI product, ask the vendor:
- Does it connect directly to the tool your team uses most?
- Can it only read your data, or can it also write back (update a record, file a ticket, send a reply)?
- What does setup take: hours, days, or a developer?
If you run Microsoft 365, add one check of your own before you turn on Microsoft 365 Copilot. As Microsoft's documentation explains, Copilot can draw on any file, email, or chat a person already has permission to open, so files that are shared too widely in SharePoint, OneDrive, or Teams become much easier to find. Review who can open what first. Least-privilege access (giving each person only the access they need) is one of the five essentials in our small-business cybersecurity checklist.
How to score it:
- Green: the tool connects to your core systems with no custom development.
- Yellow: it connects through a third-party connector such as Zapier.
- Red: it does not connect at all, which means manual copying and a separate workflow. That is usually a deal-breaker.
5. Data privacy: do you know where your data goes?
This is the easiest question to skip, and it is the one that creates legal and reputational exposure. When an employee pastes a customer contract into an AI tool to get a summary, where does that contract go? When an AI assistant reads your inbox to draft replies, what does the vendor keep, and for how long?
The answer depends on the tool and on the plan you are on. As of November 2026, the major vendors handle training on your conversations like this:
| Tool | Personal plans, free and paid | Business plans |
|---|---|---|
| ChatGPT (OpenAI) | Free and paid personal plans (such as Plus and Pro): chats are used to train models unless you turn that setting off | Business and Enterprise: not used for training by default |
| Claude (Anthropic) | Free and paid personal plans (such as Pro and Max): you choose whether your chats are used for training | Team and Enterprise: not used for training by default |
| Gemini (Google) | For adults, the Gemini app's activity setting is on by default and lets Google use chats to improve its services, including training its AI models | Google Workspace with Gemini: not used for training without your permission |
| Copilot (Microsoft) | Microsoft 365 Personal and Family: not used for training. The standalone Copilot app: Microsoft's current privacy pages do not say, so treat it like other consumer tools | Microsoft 365 Copilot with a work account: not used to train the underlying models |
Vendors change these terms, so check the current privacy page for every tool your team uses. Before any AI tool touches real business data:
- Read what the vendor does with your inputs, and how long it keeps them
- Make sure your team uses the business account, not personal accounts (paid personal plans such as ChatGPT Plus or Claude Pro are still consumer plans)
- Check any rules that apply to your industry, such as HIPAA, PCI DSS, or state privacy laws
How to score it:
- Green: your team uses business accounts, and you have checked the data terms for every AI tool it uses.
- Yellow: you pay for business plans but have not read the data terms.
- Red: you are not sure which plans your team uses or where the data goes.
AI tools inherit your security gaps. If you have not checked the basics lately, the free Security Checkup takes about two minutes and shows which of the five cybersecurity essentials you have in place: multi-factor authentication, phishing training, fast patching, tested backups, and least-privilege access.
How do you score your AI readiness?
Give yourself 2 points for each green, 1 point for each yellow, and 0 points for each red.
| Question | Green (2 points) | Yellow (1 point) | Red (0 points) |
|---|---|---|---|
| 1. Clean data | Yes to all three data checks | Yes to two | Yes to one or none |
| 2. A clear use case | At least one specific task named, steps mapped | A general idea, steps not mapped | Not sure where the time goes |
| 3. Team habits | Rules agreed, even informally | People use AI, never discussed | Unknown who uses what |
| 4. Connected tools | Works inside your core systems | Needs a third-party connector | No connection, manual copying |
| 5. Data privacy | Business accounts, terms checked for every tool | Business plans, terms not read | Unsure of plans or where data goes |
What your total means:
- 8 to 10 points: ready to pilot. Pick your first use case this week, run it for 30 days, and measure the hours it saves.
- 5 to 7 points: close the gaps first. Spend one to two weeks fixing your yellows and reds (often a one-page AI policy and a check of which plans people use), then start a small pilot.
- 0 to 4 points: build the foundations first. Get an honest picture of where your technology and data stand before you buy a new tool. That starts with a conversation, not a purchase.
One rule overrides the total: a red on clean data (question 1) or data privacy (question 5) means close the gaps first, whatever your score. A high total does not make up for customer data going somewhere you cannot see.
What are the fastest first wins with AI?
Once you are ready to pilot (8 to 10 points, or 5 to 7 after you close your gaps), these two projects tend to pay off fastest, without technical expertise or a long setup.
First win: email drafting and follow-up
Writing is the most common use. In the Federal Reserve Banks' 2025 Small Business Credit Survey, 83% of the small employer firms using AI said they use it for writing or marketing, ahead of individual productivity tasks (61%) and customer service (29%). The time savings are meaningful but modest. In a six-month randomized study of 7,137 knowledge workers at 66 large firms, workers who used Microsoft 365 Copilot spent about two fewer hours a week on email in the second half of the study.
How to start: connect an AI writing assistant to your email, write three to five templates for your most common messages (new lead follow-up, invoice reminder, support reply), and have your team use them as starting drafts instead of writing from scratch.
Second win: internal reports and summaries
If someone spends more than two hours a week pulling together a report that others read in five minutes, that report is ready for automation. AI tools can pull from your existing data, apply your format, and produce a first draft in minutes.
How to start: pick your most time-consuming recurring report, list the data sources it draws from, and set up an AI tool to draft it on a schedule. A person reviews and approves it before it goes out.
What are the risks of starting before you are ready?
Shadow AI is probably already in your business. When there are no rules, people bring their own tools, often on personal accounts that may train on what they paste in. Rather than banning AI, write a one-page policy that names the approved business tools and the data that never goes into them.
AI-written content needs a human edit. A Semrush study published in April 2026 ran about 42,000 top-ranking blog posts through an AI detector. Of the posts in the number-one Google position, about 80% were classified as human-written and about 9% as purely AI-generated. If you use AI for anything customers will read, have a person edit it before it goes out.
Switching tools later is harder than it looks. Moving your work from one AI tool to another is painful once it is woven into how you operate. Before you commit, confirm you can export your data, templates, and history in a standard format.
Frequently asked questions
How do I know if my small business is ready for AI?
You are ready when you can name at least one specific, repetitive task to hand to AI, your data is reasonably organized, and you have confirmed the tool handles your business data in a way that meets your privacy requirements. You do not need a perfect score. You need to know where your gaps are before you start.
What should a small business use AI for first?
Start with one repetitive writing or reporting task, such as drafting replies to routine emails or turning data you already have into a weekly report. Writing is the most common use: in the Federal Reserve Banks' 2025 Small Business Credit Survey, 83% of small employer firms using AI said they use it for writing or marketing.
How long does it take to get a small business ready for AI?
Scoring yourself on the five questions takes one sitting. If you score 5 to 7, plan one to two weeks to close the gaps (often a one-page AI policy and a check of which plans people use), then run a 30-day pilot. If you score 0 to 4, start with your data and your team's habits before you set a timeline for any new tool.
What is the biggest mistake small businesses make with AI?
Buying a tool before choosing a use case. Start with one high-friction task, get it working, measure the time saved, and then move to the next. Broad AI adoption without a defined starting point usually stalls.
How much does AI cost a small business per month?
About $30 a month at the median for small businesses that pay for AI tools. A JPMorganChase Institute study of payment data from 4.6 million small businesses found that firms paying for AI spent a median of about $30 a month in 2025, while firms that had paid for AI since 2019 spent closer to $90. As of November 2026, business plans from the major vendors list at about $20 to $25 per user per month (ChatGPT Business and Claude Team require at least two seats, and Microsoft 365 Copilot Business is an add-on to a Microsoft 365 business subscription), and Google includes Gemini in its Workspace Business Standard plan, which starts at $14 per user per month on an annual plan.
Is it safe to put customer data into ChatGPT or Copilot?
Only on a business plan, and only after you have checked the data terms. Personal versions of several AI tools can use your conversations to train their models by default, while OpenAI, Anthropic, Google, and Microsoft all say they do not train on data from their business plans by default. Check the current terms before you connect any AI tool to customer or financial data.
Do I need an AI policy if I only have a few employees?
Yes, but it can fit on one page. List the AI tools people may use, the kinds of data that never go into them (customer records, financial details, passwords), and who to ask when someone is unsure. A short written policy is the simplest fix for shadow AI.
Do I need an IT partner to implement AI?
Not for simple uses like drafting email or summarizing documents. For anything that connects AI to your core systems (your CRM, accounting software, or Microsoft 365 permissions) or lets AI take actions on your behalf, an IT partner can save you time and help you avoid mistakes that are expensive to undo.
What should you do next?
Whatever your score, the next step is the same: turn your weakest answer into a plan. Hawkins Consulting offers a free AI Opportunity Review for growing businesses as part of our AI services. We assess your current systems, identify your highest-impact starting points, and give you a scored readiness report and a 90-day action plan, with no enterprise complexity, no jargon, and no pressure.
Book a free AI Opportunity Review, or start on your own with the free AI readiness assessment.
Sources
- Intuit QuickBooks, 2026 AI Impact Report (May 2026)
- Federal Reserve Banks, 2026 Report on Employer Firms (March 2026; findings from the 2025 Small Business Credit Survey)
- Goldman Sachs, Goldman Sachs Commits $500 Million to Launch Small Business AI Institute and Expand 10,000 Small Businesses (October 22, 2026)
- Goldman Sachs 10,000 Small Businesses, The AI Economy Is a Small Business Economy (October 2026; alumni survey fielded August 2026)
- SBA Office of Advocacy, AI in Business: Small Firms Closing In (September 2025)
- WatchGuard, Employees Drive Rising Cybersecurity Risk As Shadow AI and Unsafe Work Habits Surge (July 2026; survey fielded April 2026)
- National Bureau of Economic Research, Shifting Work Patterns with Generative AI, Working Paper 33795 (May 2025, revised November 2025)
- Semrush, Does AI Content Rank Well in Search? (April 2026)
- JPMorganChase Institute, Understanding the Use of AI Among Small Businesses (April 2026)
- Microsoft, Data, Privacy, and Security for Microsoft Copilot and Enterprise data protection in Microsoft Copilot and Microsoft Copilot Chat (Microsoft's documentation for Microsoft 365 Copilot)
- Vendor data-use pages: OpenAI personal plans, OpenAI business plans, Anthropic consumer terms, Anthropic plans, Gemini activity settings, Gemini Apps Privacy Hub, Google Workspace with Gemini
Statistics and vendor terms checked November 2, 2026.